Privacy.
Your boards are yours.

§ 01Who's responsible

sampsa.dev oy (Y-tunnus 3183970-6), Fredikanterassi 7 C 120, 00520 Helsinki, Finland, runs Taulu and is the controller of your account data. For what your team puts on its boards, your org is the controller and we process it on the org's behalf, under the terms in § 12 of our terms. Reach us at support@taulu.app.

§ 02What we collect

Two kinds of data. Account data (your name, email, org membership, profile picture, the ways you sign in, the devices you're signed in on, when you were last active, and the tokens of any tool you connect for an import), which you give us to run your account. And board data (the cards, stickies, comments and attachments your team makes), which we hold on your behalf. We collect the minimum to run the service and never buy data about you from third parties. If you choose Help improve for product analytics, we also keep which weeks you used Taulu and a few first steps you reached, like your first invite, linked to your account and never to board content.

§ 03How we use it

To operate Taulu: authenticate you, sync boards in real time, send the emails the product needs (sign-in links, invites), and keep the service healthy through error reporting and server logs. We do not sell your data, and we do not run ads.

§ 04Why we're allowed to

Running your account, signing you in and billing your org rest on our contract with you. Security and access logs, handling abuse, error tracking and the profile picture lookup rest on our legitimate interest in keeping Taulu safe and working; you can object to them by writing to us, and turn the picture lookup off yourself. Product analytics and product email rest on your consent, which you can withdraw any time in Settings › Privacy. Invoices and accounting records are kept because Finnish accounting law requires it, for as long as it requires.

§ 05AI and your boards

Five AI features exist, and all are off until an org admin turns them on in the organization's privacy settings: photo import (a whiteboard photo becomes board items), recording import (an audio memo, or a meeting you record with the Record meeting button, becomes a transcript and cards), the meeting notetaker (below), selection summary (the items you select become a memo and action cards) and consented voice-room recordings (below). Each one runs only when someone on the board asks for it, and only what that person picked is processed by Mistral AI (EU): the file you submit, or the text, images and PDFs of the items you selected, including everything inside a frame you selected. The result comes straight back to your board. We send nothing else from your boards to an AI provider, and no models are trained on your boards. Not ours, not anyone else's. If your org connects its own agent, that agent reads only the boards it was granted, through an AI provider your org chose.

Voice rooms are end-to-end encrypted between the people in a room: the room key is made in your browser or phone and exchanged directly between participants, so our media server relays encrypted audio it cannot decrypt, and our application server never holds a key. Rooms are ephemeral; nothing of a call is stored unless everyone in the room agrees to a recording. A recording asks each person present, starts only when all have said yes, stops the moment anyone withdraws, and runs through the same Mistral AI pipeline as a recording import; the audio is deleted as soon as the transcript, memo and cards land on the board. Each consent is logged with a fingerprint of the exact text you agreed to.

The meeting notetaker joins a Google Meet, Zoom or Teams call only when someone on the board pastes that call's link. It joins under the name “Taulu notetaker”, says in the call's chat that it is recording, and records audio only, never video. It runs on Recall.ai's EU deployment in Frankfurt. When the call ends we fetch the audio and the speaking timeline (who spoke when, by display name), delete the recording at Recall.ai, and run the same Mistral AI pipeline as a recording import; the audio is then deleted here too. The meeting link goes to Recall.ai and is never stored by us. The person who invites the notetaker is responsible for the people in the call knowing about it, the same as for a recording they upload.

§ 06Sub-processors

We use a short list of sub-processors: UpCloud (servers, database and object storage, EU), Bunny.net (DNS, CDN and video delivery, EU company), Mailjet (the emails the product sends (sign-in links, invites, notifications); EU), AppSignal (server error and performance monitoring, which sees your user id but never board content; EU), Mistral AI (photo import, recording import, the meeting notetaker's transcripts, selection summary and consented voice-room recordings only, EU) and Recall.ai (the meeting notetaker only: it joins the calls you invite it to and records their audio; EU deployment in Frankfurt, operated by a US company). We email org admins 30 days before adding one, and they can object. What each one receives, and where, is laid out service by service on the security page.

§ 07Other companies that receive data

A few companies receive data from us but decide for themselves how to handle it, under their own privacy policies. Paddle sells you the subscription as merchant of record and receives your billing email and company details (UK/US). Automattic (Gravatar) looks up profile pictures: once per account, our server asks Gravatar whether a picture exists for a hash of your email; Gravatar sees our server, never your browser or IP, and you can turn the lookup off in Settings › Privacy (US). Google and GitHub take part only when you sign in with them. Miro, Trello, Asana, Jira, Mural and Monday take part only when you connect one of them for an import.

§ 08Data residency

The application and its database run in Helsinki, Finland, on EU-owned infrastructure. Attachments and backups sit in object storage in Finland, Sweden and Germany, videos in Frankfurt with a copy in Stockholm, and our CDN is restricted to EU edge locations. Sign-in and import services you choose to connect (§ 07) are your call. Beyond them, three exceptions reach outside the EU, all named above: payments run through Paddle (UK/US), the opt-out profile picture lookup asks Gravatar (US), and the meeting notetaker runs on Recall.ai, whose EU deployment keeps call audio in Frankfurt but whose operator is a US company, so transfers rely on the EU Standard Contractual Clauses in its data processing agreement. We will tell you, in advance, before any of this changes.

§ 09If you're not a Taulu user

You may be on a board without having an account: someone recorded a call you were in, invited you by email, or wrote about you. We then process your data for that person's org, which decides what happens to it. Ask them first. If you can't reach them, write to support@taulu.app and we'll help.

§ 10Your rights (GDPR)

You can access, correct, export or delete your data at any time. Delete your account yourself in Settings › Account, or email support@taulu.app: we fulfil access, export and deletion requests within 30 days, usually much faster. You can also object to processing and lodge a complaint with a supervisory authority: in Finland that's the Data Protection Ombudsman (tietosuoja.fi), or the authority where you live.

§ 11Cookies

Practically none. Signing in works with a token in your browser's local storage, not a tracking cookie, and the boards you open keep an offline copy in your browser's storage so edits survive a lost connection. The only true cookies are technical: one exists only during a Google or GitHub sign-in to protect the handshake and expires right after, and one lives for ten minutes while you connect a tool for an import. No advertising or cross-site tracking cookies. What you will meet once, at your first sign-in, is a consent screen: it asks you to accept these terms, and offers two optional choices, product analytics and product email, that start off and can be changed anytime in Settings › Privacy, each stamped with when you decided it. Product analytics has three levels: off, anonymous feature counts that are never linked to you, or Help improve, which also links your weekly activity to your account. Lowering it or closing your account deletes that linked record.

§ 12Retention and deletion

Board data lives as long as the board does. Delete a board and it sits in Trash for 7 days, then it's purged. Delete your account in Settings › Account (or ask us to) and it is anonymised at once and purged within 30 days, except what we must keep for legal reasons; invoices, for one. Server and access logs, which include IP addresses, are kept for up to a year for security; your org's audit log names people by id and lives as long as the org. Database backups are kept for 30 days and expire on their own, so a deletion reaches them inside that window rather than instantly.

§ 13Contact

Questions, requests, or concerns go to support@taulu.app. We read every message and prefer to resolve things directly before anything formal.